Desktop Virtualization Savings: It's in the Approach

One of the things we keep hearing from prospects about desktop virtualization is cost. In fact, in a meeting with our CIO Council this spring, the CIO of a major Wall Street bank said this firm’s investments in a virtual desktop infrastructure (VDI) solution had so ballooned out of proportion and the experience had been so painful that it’s left permanent bad taste in everyone’s mouth. There’s no way, he contends, that he could ever sell “desktop virtualization” to his firm again – management and end users alike.

That point really inspired us to work on a TCO model – so companies know what the costs entail before they commit to a desktop management path. Fundamentally, desktop virtualization is about easier desktop management and cost savings the icing on the cake.

In our TCO calculations, we show how MokaFive can dramatically cut desktop TCO by at least 45% by delivering savings in three areas:

1. Operational costs;
2. Helpdesk costs; and
3. Capital costs.

Operational Savings. MokaFive’s management model -- central management and distributed execution – is unique in the market, and critical to lowering overall TCO. The IT administrator creates one golden image, called the LivePC, which is sent down to thousands of users. To patch or update OS or applications, IT updates the single golden image in a central location, and automatically the changes are distributed to users’ machines. Contrast that to traditional software distribution, which requires every endpoint to be individually patched which can result in errors, complications and costs. (It’s no wonder companies are dreading the Windows 7 migration – and I am not at all surprised by the costs.)

Helpdesk Savings. MokaFive also delivers savings in helpdesk costs. Typically the most expensive calls occur when a user corrupts their machine with a virus. With MokaFive’s rejuvenate capability, a corrupted desktop can be “rejuvenated” back to its pristine state with all personal data intact – all with just a click of a button. The user doesn’t have to even make a helpdesk call or be online. The CIO of one of our earliest customers – a major law firm in Silicon Valley – recently raved to me about the unexpected savings in their helpdesk costs. They hadn’t even calculated it into their models (nor we, for that matter), but we now expect them to have paid for their initial investment in the next year.

If not for MokaFive, this customer’s helpdesk would be fielding level two and level three calls when a user corrupts their machine with a virus. This specific case calls for a desktop re-image, which can be a very cumbersome process taking hours, if not days to complete. When you re-image the machine, IT needs to supply a new OS, restore all the applications, and then re-apply all the user data.

We estimate steady state this is going to be true whether it’s a VDI instance or with software distribution because even in a VDI scenario the user has to make a helpdesk call and the administrator has engage and to revoke the VM and put the data back on.

Capital Savings. With MokaFive, enterprises have the option to implement BYOC (bring your own computer) programs for employees and contractors. Cisco and Dell made headlines last year when they initiated BYOC programs giving their employees a stipend to purchase their own computer. Both used virtualization to deliver company approved applications, but their approaches had significant limitations. In Dell's case, the only real choices was, well, Dell machines. Cisco at least allowed more latitude, so employees could purchase Macs, but "they are pretty much on their own for tech support." With these traditional desktop management models, and even with VDI, BYOC hits a snag due to online-offline access issues.

With MokaFive, IT deploys and manages the virtualized corporate environment on employee-chosen machines (Mac or a PC, online or offline) using MokaFive and benefit from the central management and distributed model I discussed above.

Going Green. There is one final area of savings I'd like to highlight -- though it may not necessarily be considered by CIOs when making a decision on desktop virtualization: the environmental impact. With MokaFive's approach, companies can use existing equipment; existing personal devices and existing corporate devices. In the case of contractors, companies are no longer buying assets, nor are they provisioning servers to the datacenter. All these add up to a reduction in new power-hungry equipment. MokaFive’s approach give you almost status-quo type of energy in the case of most work from home and contractor scenarios – and is even more effective than what we have today. I go into a lot more detail on this in an earlier post.

For our customers, the savings in all these areas have been very real. But the fact remains that desktop virtualization has over-promised and under-delivered for many years -- to the detriment of all of us. Just because two (with a third making very fast progress) very large vendors dominate virtualization, it doesn't mean innovation has ceased. It's still happening, and MokaFive is proof of it, 20+ patents and still coming.

We've really put a lot of thought into all the costs associated with managing desktops. Our customers have weighed in and helped us create a TCO model that factors in these four areas. We invite you to sign up for a personalized TCO for your environment.

Purnima Padmanabhan, VP of Products and Marketing

Windows 7 Migration Just Got Easier with MokaFive Suite 3.0

Today, MokaFive hit a significant milestone: the release of MokaFive Suite 3.0.

We began pilots over two years ago with some early adopter customers. Since then, these customers have gone into production – in some cases even increasing the size of their deployment – and now they’re beginning to see real, tangible business benefits from a centrally managed, distributed execution approach to desktop virtualization:

• A Silicon Valley-based international law firm saw its employee satisfaction ratings skyrocket
• A Global investment banking and securities firm whose traveling executives can carry one laptop (either a  Mac or PC) for both work and personal use

I point to these customers because their feedback has been absolutely critical for what we are delivering in version 3.0. This is the next-generation evolution of our product. We have made it Windows 7 ready, truly integrated into the enterprise with more policy controls and security features, and we hope to get more leverage from a market perspective with a multi-tenant managed services model.

Full Windows 7 support.

In my recent blog about the costs of Windows 7 migrations, I argued that this massive IT disruption could be a golden opportunity to future-proof the management architecture. And with 3.0, we’ve given IT leaders just that.

Rather than having to go from one desktop to the next and one office to the next over a 12 to 30 month period to manual upgrade machines, enterprises can implement MokaFive Suite to create a full Windows 7 VM that runs on existing hardware – and still access legacy applications – without waiting for the hardware refresh cycle. This means no additional capital costs to migrate to Windows 7, and companies can refresh hardware on their own timeline.

MokaFive’s Windows 7 support is not just a container. We now have full layering support on Windows 7 both in terms of AD domain join layering, OS layering, user-installed apps, data and settings.  We have changed the architecture of the layering so that it leverages some of the inherent features of Windows 7 much better.

Data center to endpoint security.

In the past, we’ve often talked about our seven layers of security, but for MokaFive Suite 3.0, we upped the ante with security at the device level.

With server hosted desktop virtualization solutions, you can secure the data in the data center, but how do you ensure that the browser accessing the VM is not being screen-scraped at the endpoint? Back in August, we announced a partnership with AVG to solve exactly this security gap; MokaFive Suite 3.0 now takes advantage of this full integration. The solution includes a secure virtual encrypted desktop container that can be deployed to the endpoint and further be secured from key-logging and screen-scraping attacks from the host machine by the AVG security scanning capability. Now virtual desktops can be a secure container that can be accessed by many devices, both corporate and personal.

Desktop management as-a-service.

We’ve been talking to some managed service providers that wanted to be able to leverage MokaFive Suite to deliver desktop management services to multiple organizations and their end-users. It seemed like a great idea, so we created a multi-tenant infrastructure as well as new reporting tools and the ability to delegate management to any tenant.

We see 3.0 valuable to three types of providers:

• Outsourced services firms currently using “brute force” to manage desktops for their clients. Now, with a single platform, they can increase the operational efficiency of their delivery model.
• Service providers and carriers that want to expand their footprint with a client or to add a new revenue stream.
• Hosting companies that have no specific desktop management expertise but want to add more services and move beyond providing just rack space.

These are the three big-ticket items in version 3.0, but we have many, many more features. Check out Brian Madden's latest blog post for more info and video interview.

Purnima Padmanabhan, VP of Products and Marketing



Local CPU is becoming MORE important

I caught up this week with Intel's technology evangelist, Charlie Milo, at the Intel Developer Forum, for an update on some of Intel's exciting new technologies, including accelerated 3D graphics, 3D television sets, 3D photos and cameras. One of the items that was showcased at IDF was Internet Explorer 9, which was released by Microsoft in beta yesterday.

Inevitably in our conversation, we discussed the impact of having such a browser; that is, one that renders graphics beautifully on the endpoint, on desktop virtualization. Through that discussion, it became clear that this browser will use a lot more CPU cycles to deliver the high-definition graphics and 3D images that we, the consumers, want. The question then becomes, where do you want this processing power to be executed? On an expensive server sitting in a data center, or on the endpoint?

Rendering rich 3D graphics requires a lot of power and speed, and more importantly needs to be computed close to the user for a rich, interactive experience. The data crunching can happen on the server, but in terms of rendering the graphics, it has to happen on the endpoint.

To me, these rich interactive performance applications further validate the bet we have placed on the client side, where virtual desktops are executed on the distributed resource.

How do you think the coming new browsers will impact desktop virtualization?

  Purnima Padmanabhan, VP of Products & Marketing

It’s Official: MokaFive Goes BareMetal

Regular readers of this blog will recall that in June, we blogged about MokaFive BareMetal Player, which we were taking the wrappers off for industry insiders at BriForum. At VMworld we made our bare-metal preview official and demoed it to an appreciative audience. 

This comes, of course, at an interesting time. Just last month in its earnings call, , VMware killed its bare-metal hypervisor.  And just last week, Citrix decided to package its long-awaited XenClient bare-metal hypervisor with XenDesktop in an effort to get it to market faster.

With all the news, our bare metal solution was received as a welcome change.  The sentiment was echoed by Timothy Prickett Morgan of The Register in his eloquent (and irreverent) coverage of VMware, Citrix,  MokaFive and more.

We developed MokaFive BareMetal Player because our customers are asking for a solution that lets them forget about everything except the VM. They want to be able to run directly on the hardware and they want the same management they’re used to already with MokaFive Suite. And that’s exactly what we have with bare-metal: it provides a thin management layer that sits on the baremetal hardware, thus eliminating the cost  burden of managing additional OS’s and licenses.

Best of all, MokaFive BareMetal adheres to our commitment to deliver “choice computing.” In the bare-metal world, that means supporting a broad range of hardware—not half a handful of narrow configurations, and certainly not hardware deals cut in the backroom to lock customers in.

We believe our BareMetal will be a real game-changer in the desktop virtualization space. Like MokaFive Suite, BareMetal is designed to fit into existing infrastructure and to always be OS- and hardware-agnostic.

Take a look at this link of John Whaley’s video chat with Brian Madden at our VMworld booth. Generally, the response to BareMetal has been on par with Brian’s reaction – great! NetworkWorld even listed us as one of the hottest Vendors at VMworld.

 Purnima Padmanabhan, VP of Products & Marketing

Going Green with Virtual Desktops

Everyone is talking about Green IT these days, and virtualization is a popular way to save money and reduce your environmental impact at the same time. Many companies have already discovered the benefits of virtualizing their servers, so the natural progression is to begin looking at virtualizing their desktops, as well.

There are several environmental benefits to using virtual desktops, but it all depends on the type of approach—whether you’re using server-based (VDI) or client-based virtual desktops. In the past, we have blogged about the shortcomings of VDI, such as cost and lack of offline support. From a Green angle, the problem with VDI is the huge datacenter infrastructure it requires, and more servers mean more space, increased power consumption, and increased cooling costs. The additional servers required by VDI more than offset any green savings you might see, and as a result, VDI is actually less Earth-friendly than traditional desktops. In contrast, a client-based solution (like MokaFive) requires no additional datacenter infrastructure.

Let’s compare the green impact of MokaFive vs. VDI. Gartner predicts that 49 million endpoints will be virtualized by 2013. Let's assume 30% will be laptops and remaining will be desktops. Based on those assumptions if all of those desktops were virtualized using MokaFive (instead of VDI), we would prevent 7.8 million metric tons of CO2 emissions each year—that’s the equivalent of taking 1.4 million cars off the road per year!

Another environmental benefit of client-based virtual desktops is the need for fewer machines. Virtualization allows you to use existing machines for multiple purposes: for example, an employee can use the same laptop for home and work. As a result, you can avoid the carbon footprint of an additional machine, including the energy and cooling it requires.

In addition, telecommuting is growing in popularity, and virtual desktops are helping to drive that trend. With centralized management, IT can easily support remote workers’ desktops, and employees have the flexibility of accessing their corporate desktop anytime, from any machine. Remote workers are environmentally friendly, too: they take cars off the road, and they save on office emissions (consider the space, energy, and cooling that each cubicle requires).

Desktop virtualization is a great way to reduce your IT costs and help save the environment at the same time. Just keep in mind that the type of virtualization approach makes a big difference, and client-based virtual desktops are by far the greenest option.

Purnima Padmanabhan, VP of Products & Marketing

VDI post on Madden: good observations, different conclusions

Last month, I predicted that VDI will be just a niche play as the cloud matures. Yesterday Brian Madden posted a dramatically different perspective about the extent to which VDI will penetrate computing.

This perspective was not his own, but he thought it interesting enough to write about it. The problem though is that although the observations are reasonable, the conclusions are awful.

Let's look at specific examples.

First, the post notes that computing is changing rapidly, and of course I agree. More apps are moving toward the cloud for simplicity and portability reasons. The apps that will be left behind are rich applications that require local execution. The problem with VDI in this scenario is that you get the worst of both worlds: you get neither the simplicity of the cloud app, nor the functionality of a local app. It just doesn’t make sense to take your fat desktop and stick it into the cloud (except in niche scenarios), since VDI will only become more cumbersome as the cloud matures.

A second observation in the post invokes Moore’s law, saying that as servers become better and cheaper, the cost of VDI will drop. This might be true if users continue to use the same applications, but that’s not how computing works. Applications will continue to expand and consume the additional server bandwidth, negating any savings from Moore’s law.

Thirdly, the post goes on to describe deployment models. The primary pain point that desktop virtualization solves is desktop deployment and centralized management. With a client-based solution, IT can provision an additional VM simply by publishing an html link and sending an email. It’s cheaper, faster, and more resilient than provisioning additional boxes in the datacenter, as you do with VDI.

The post also completely ignores some fundamental issues with VDI. For example, a defining characteristic of VDI is the pooling of resources in the datacenter, but the downside to pooling is that you are magnifying the risks and complexity of desktops—the classic “eggs in one basket” problem. With VDI, you are taking inherently resilient, distributed desktops and turning them into a highly concentrated system that is vulnerable to malfunction. With VDI, if the system goes down, all your desktops go down. A related problem is that IT has to over-provision in order to prepare for peak capacity (e.g., 9:00am on Monday morning). But it’s difficult to predict group behavior, and your “over-provisioning” may prove inadequate, anyway.

Finally, the post fails to address Madden’s own Offline Paradox. Offline capability is at the core of VDI’s shortcomings. There are many times when a user finds himself without an Internet connection, such as on a plane or when the connection goes down for whatever reason. With VDI, users without a connection are unable to access their virtual desktops. This is a key area where a client-based approach excels.

What do you think the future holds? Will virtual desktops live in the datacenter or on the host machine?

Purnima Padmanabhan, VP of Products and Marketing

Introducing MokaFive on BareMetal

We’re gearing up for BriForum this week, and for us, the highlight will be a sneak peak of an exciting new product that we have been working on: MokaFive BareMetal. Starting today, you can see for yourself what this solution is all about. Stop by our booth (#300) for the demo by MokaFive’s CTO, John Whaley.

The idea behind BareMetal is to provide a thin management layer that sits on the bare metal hardware. This is still in development so we don’t want to comment on the implementation details, but the benefits of BareMetal are clear: broad hardware support, extensive policy set, and the best management control in the industry.

If you’re familiar with MokaFive, you know we came out of the gate with support for VMware Player, and recently added another hypervisor to our arsenal – VirtualBox. Now, with MokaFive BareMetal, we’re going to eliminate the OS-middleman and enable users to run directly on the hardware itself.

So, why are we adding BareMetal? For one, it supports our commitment to be truly platform- and hypervisor- agnostic. Equally important, if not more, our customers have been asking for it. Those customers that are already running our Type-2 hypervisor based solution for their laptops and BYOC or employee owned devices are now looking to expand MokaFive management across all corporate desktops. With the BareMetal solution, customers will be able to use just a single Windows guest OS instead of licensing & paying for both the VM and the host OS. And the best part is that they can roll out the same virtual image, as well as policy controls, to both end users’ personal machines (using our Type-2 solution) as well as corporate-issued ones (using our BareMetal solution), with no additional management burden.

For the image, you can use the same image that you’re using for current deployments (BYOC). For installation of BareMetal, there will be a few different methods from which you can choose. Similar to other physical machines, you’ll be able to install it with installation ISOs, or over the network via a PXE server. I’m biased of course, but we have a solid solution here that dramatically simplifies management – of desktops and licenses – for customers.

If you’re at BriForum, be sure to come check out our BareMetal demo at booth #300. And while you’re there, Futurama fans should be sure to enter MokaFive’s drawing for a Bare Metal Bender.

Purnima Padmanabhan, VP of Products and Marketing

What is the right virtual desktop model for BYOC?

A recent blog post by Brian Madden compares the security differences between Type 1 and Type 2 hypervisors. Brian writes that Type 1 bare-metal hypervisors are “possibly more secure due to the smaller attack surface of the hypervisor.” But he’s quick to point out that neither Type 1 nor Type 2 hypervisors are a one-size-fits-all solution.

After reading Brian’s blog, I thought about MokaFive’s approach to security. The problem with security is that you can’t talk in absolutes: the discussion depends on both the use case and its associated risk profile. If you are completely intolerant of risk, then you have to ignore the benefits of most Internet-based computing and keep your computer offline, locked up in a dark room. But in the real world, you have to support mobile and offline workers so they can be productive, and with that comes some risk. This is true of any computing model, but it’s important to mitigate that risk by choosing the best technology for your needs.

Let’s specifically look at the BYOC model where organizations want to enable computing on employee-owned machines. While there are many models to deliver specific applications from the cloud using technologies such as terminal services or even app streaming, these don’t provide the full usability of the entire desktop environment. So, what are the options for BYOC? There is VDI, but it provides no offline access and contrary to popular belief is not completely secure, either. While the VDI desktop lives in the datacenter, IT has no way to control the endpoint machine accessing the VDI session. Those endpoints could have keyloggers or screenscrapers that can siphon data from the VDI session.

In contrast, with the client-side models, a fully encapsulated VM is delivered to the endpoint, either directly on baremetal (with Type 1 hypervisor), or on top of an existing OS (with Type 2 hypervisor). There is almost unanimous agreement that a Type 1-based model will not work for BYOC, since no user will allow IT to forklift their personal machine. Only when Type 1s are shipped with OEM machines will this model will become viable for BYOC.

Net-net, a Type 2-based client-side model, where a fully managed, encapsulated VM is delivered on top of the user’s existing OS, is ideally suited for BYOC. It provides users access to the corporate environment anytime, online or offline, without impinging on their personal machine environment.

MokaFive supports a Type 2 model today while allowing you to grow to a Type 1 approach in the future. We leverage the MokaFive player residing on the client to provide additional protection against risks associated with BYOC. I have outlined below our approach with seven layers of security that protect against your concerns:

1. Host checker

• Checks for basic performance characteristics of the machine. It can also be extended to check for any other security characteristics of the host (such as configuration and execution status of anti-virus software) prior to the launch of the virtual desktop.

2. VM encapsulation

• Encapsulates a full, locked down OS controlled by IT. This allows IT to completely control the patch level and GPO security settings.

3. VM encryption

• Encrypts image with AES 256, including the base image and all user data. We also intercept all I/O that the hypervisor writes to disk or to memory, and this data is compressed and encrypted.

4. Tamper resistance of both code and policies, and copy protection

• Attempts to alter the executable or configuration will disallow the Player from running. Also, by policy, IT can disallow users from moving images from one machine to another.

5. AD authentication / Two-factor authentication (RSA or PKI)

• Integrates with Active Directory to enforce users’ authentication prior to virtual image access. Optionally, IT can configure RSA SecurID or PKI as a second authentication factor for additional security.

6. SSL

• Communicates with the server over SSL. Clients validate the server’s SSL certificates against a Certificate Authority.

7. Policies

• Enables administrators to have fine grained, centralized control of operational and security polices, such as peripheral access, and ability to drag and drop files from host to guest or vice versa.

Simply put, MokaFive is one of the few vendors that provides a secure, fully managed virtual desktop model for a BYOC model. Stay tuned: in an upcoming blog, we will talk about BYOC best practices.

Purnima Padmanabhan, VP of Products and Marketing

Going to BriForum 2010?

This year’s BriForum conference is coming up June 15 – 17 in Chicago, and we’ll be there with some exciting announcements and demos (hint: some new, really cool things straight from our lab).

Make sure you catch John Whaley, our CTO, who will present two sessions:

• “BYOPC: IT Panacea or Management Nightmare”(8:45 am on Tuesday, June 15). John will cover some of the pros, cons, and lessons learned from actual and attempted BYOPC deployments.

• “Understanding and Optimizing Disk Access Patterns for Desktop VM Workloads”(2:30 pm on Wednesday, June 16). This highly technical session will dive deep into what typical desktop VM disk access workloads look like and how to measure IO performance in a way that mirrors the users' perception.

Also, swing by our booth (#300) to see our demo. I’m really looking forward to meeting you all face-to-face. If you’d like to set up a meeting in advance, please contact Lynsey Rose at lrose@mokafive.com.

Purnima Padmanabhan, VP of Products and Marketing

Cloud and the Evolution of Client Computing

The headline of Mark Bowker’s article in Network World recently caught my attention: “Will Cloud Lead to the Failure of VDI?”

No equivocations on my part; the answer is a resounding yes. Today, there are multiple deployment models, but fast forward to three to five years from now, when cloud computing becomes much more mature, and we will see only two models survive. And neither will be VDI (Virtual Desktop Infrastructure).

But let’s back up and look at what we have today.

First, there are thick client applications, such as Microsoft Office – rich applications locally executed on a desktop OS to give users a fast, seamless experience. This type of application is not going anywhere and will be around for a long time because it offers a high level of dynamic activity that cannot be rendered for a Web-only interface.

Over the last few years, a new class of applications has emerged that run in the cloud – for example Google apps or Salesforce.com. These apps are fundamentally built for the cloud and built to run on browsers from any computer or mobile device. These aren’t applications built to run locally which are just thrown into the cloud. Google is leading the charge here, with Google Chrome increasingly becoming an operating system itself. IN the near future, these apps will co-exist with thick client apps and end-users will require environments that support both models.

Somewhere in between is the third model today: VDI.

Though its proponents may say otherwise, VDI is not a true cloud-based solution. The apps were not built to run on the Web; they require rich local execution. What VDI does, in the simplest sense, is allow IT managers to put a rich local execution environment on a server and deploy it as a “cloud app,” albeit a crippled one at that. It offers none of the performance and offline use you get with a rich app nor the simplicity of a Web app. At best, VDI is a stopgap solution; it exists because most enterprise apps were not built for the Web.

In five years’ time when apps that need to run in the cloud are in fact purpose-built for the cloud, you can bet that VDI will become obsolete. In the end, we will have only two main types of applications: Rich, locally run applications for end use points and a rich set of applications built for cloud computing. Rich local execution apps will persist because computing will not be 100 percent online (yet) due to connectivity and performance. Some apps, such as PowerPoint (however much you love it or hate it), requires rich interaction, and therefore is best fit as a local, OS-based desktop application.

Interestingly, the motivation for VDI was always about central control. If VDI, as a management layer, is out of the picture, then how do you ‘control’ and centrally manage these two types of apps? We believe for rich endpoints client-side virtualization is the way to go – allowing central management of the desktop while enabling rich interactions and offline use. For the apps in the cloud – existing datacenter management tools solve the problem.

What do you think? What will a mature cloud computing environment mean for VDI?

Purnima Padmanabhan, VP of Products and Marketing

To centralize, or not to centralize

You wouldn't do this with eggs. Why would you do it with your company's desktops?

Desktop virtualization holds great promise to dramatically reduce IT support costs, while allowing end users unprecedented access and flexibility. There are now dozens of offerings to choose from. But beware – your approach matters. A lot.

Picture the last time your PC crashed. Now imagine it happening to everyone in your company. All at the same time.

It makes complete sense to centralize certain aspects of desktop management. Access and policy control, reporting and image updating, definitely. And certain compute-intensive applications. But it makes little sense to centralize execution.

Desktop execution should (almost) always be decentralized.

A decentralized system is inherently more resilient than a centralized one. No single incident can bring down the productivity of the whole. This has been a truism in computer science, and it’s proven itself in many other systems, not least of which is the Internet itself. On the Internet, no single router or gateway failure can bring down the connectivity of all the endpoints. Instead, in the case of a failure, packets are rerouted around the downed node and transmissions successfully proceed.

Similarly in a decentralized desktop environment, a single PC failure, or even the failure of the management server itself, does not stop the productivity of the whole. Sure, a single user may be inconvenienced (and we all know that certain users are more important than others :) ), but there is no chance that the entire system can come down. When we say “no chance," we don’t actually mean “low probability,” or “five 9s,” etc. With decentralization, there is *no* chance of systemic failure. Nada.

Moreover, a decentralized desktop system is usually lower cost because consumer CPU and storage is much cheaper in aggregate than the equivalent resources in the datacenter. And decentralized execution provides the best user experience, since the user can be online or offline, does not have to worry about bandwidth, and local CPU provides better performance than a centralized remote one.

Now, certain narrow use cases do warrant centralization. But the vast majority of desktops should remain decentralized.

Something to chew on

Even with 14 years of experience and a bazillion dollars, Google’s search services went down last May. What’s the likelihood that your VDI will fare better?





Caveat VDI

Your existing physical desktop environment is already an inherently resilient system. Your company (and your career) can easily survive the occasional user hard drive crash or network issue. But now you’re thinking about scrapping that beautiful architecture, and replacing it at enormous upfront and ongoing costs with an inherently more fragile and risky one. There may be a legitimate cost-risk-benefit reason for you to do this – just be sure you’ve done the analysis.

A better way

Distributed Virtual Desktops (DVDs), a term coined by IDC, represent the low cost, highly flexible world of the New Desktop (capitalization intended). In this model, like your physical desktop solution, DVDs are controlled centrally, so access control, policies, reporting and image management happen efficiently by a single team. But desktops are virtualized so the same golden image can run on any platform, and any hardware configuration. This makes it better than your current physical desktop solution.

And, in stark contrast to VDI, DVDs execute in a decentralized fashion. This means that issues (and we all know issues can happen) are isolated to a single user. As with VDI, there are multiple offerings in the DVD space—MokaFive is one. At MokaFive, the tenet of decentralized execution has been imbued from the very beginning and throughout every aspect of our product design. We believe it’s the only way to go.

Burt Toma, Director of Products

Can a platform vendor be an effective management vendor?

Today we announced a preview of MokaFive’s new VirtualBox client for desktop management. With the addition of an open-source hypervisor, we are fulfilling our vision to be truly both OS-agnostic, as well as hypervisor-agnostic, giving our customers freedom of choice. This is only our first step, and we will continue to add support for more hypervisors, including broadening our current Linux-based baremetal to address Type-1.

This made me wonder: Can an OS or hypervisor platform vendor also be an effective management vendor? In other words, is it in the customer’s best interest to buy a management solution from the same company that supplies its operating system or its hypervisor? It seems to me that it’s impossible to meet your customers’ management needs when your company is tied to one platform. If you’re Microsoft, you’re going to sell a management solution that supports Windows. But what if, down the road, the customer wants to deploy a few Macs on the network? The customer will be out of luck because they are locked in to the Microsoft ecosystem.

As enterprises undergo transformation with more remote, mobile and contract workers, different platforms will have to be deployed or managed based on specific situations. IT needs to have a management solution that is not tied to one platform and is truly future proof. We’re already helping our customers to expand choice in operating systems and in hardware. Today we’re expanding choice in hypervisors. We’ve added our first free hypervisor for Macs—the open-source VirtualBox client—in addition to the VMware Fusion we have long used.

Choice has always been an important factor for our customers, who need the freedom to purchase the IT solutions best tailored for their business, regardless of which solutions they already have in place. It all needs to work together seamlessly. Increasingly, Macs are being used in the enterprise and, with the right tools, they can be managed easily alongside PCs. I believe this is where end-user computing is going, and as such, what IT needs to factor in for their decision-making.

Purnima Padmanabhan, VP of Products

Learnings from our CIO Summit

Last month, we hosted our first quarterly CIO summit session that was attended by several CIOs representing some of the largest organizations in the US. The goal of this session was to investigate the priorities and the associated drivers for end-user computing within these large organizations. Over the course of a terrific power packed discussion, several themes emerged - one of which struck us as very distinctive.

We were expecting the usual themes around cost and control to emerge when, right at the beginning, one of the CIOs of a leading services firm said, “Look, it is not about control. IT doesn’t want to control; we just want to deliver enterprise value at the lowest possible cost, ensuring that every user is productive.” Quite a profound statement. Which brings us to the question, “Why are IT conversations always peppered with the word control?”

Upon further discussion, the answer became clear. The CIOs want to enable user productivity at the lowest cost and risk to the business. In the past, the only way to achieve a reliable, secure desktop was through lockdown and control. But over the years in many organizations, “control” has become the primary objective which, in turn, has lead to myopic decision making.

A number of influences seem to be changing this trend. One reason is that IT is required to support new business initiatives, which cannot be supported using traditional models. As the CIO for a large healthcare firm put it, “I have to enable new work models including teleworking and outsourcing. We hire talent where we get it and do not worry whether it is in the corporate location or not. These users need a secure, reliable working environment at their home, on the go, right at their fingertips at all times.” Second, there are finally a number of solutions now that can enable an IT organization to provide user flexibility without additional cost or risk penalty, so you don’t need to control and lockdown the user. In fact, client- based virtual desktop management solutions like MokaFive can significantly drive the cost and the risks down by enabling single image management across corporate and employee owned assets. (More elaboration in subsequent blog posts).

Another alternative that is commonly considered is VDI. Almost all the CIOs had investigated or were investigating VDI. But they found VDI to be too expensive, too complex, and most importantly, too restrictive for their users. This seems to be a growing sentiment and is reflected well in this article by Randy Eckel . We will explore more of the CIO comments and feedback in upcoming blogs.

Purnima Padmanabhan, VP of Products and Marketing

MokaFive, a green technology?

Yesterday we announced our new round of funding lead by NGEN Partners with contributions from existing investors Khosla Ventures and Highland Capital Partners, MokaFive Raises $21 Million in Venture Capital Funding. Over the past year, we have built a great enterprise-class product that is now deployed within large F1000 companies. With our product now proven in production, this funding allows us to rapidly scale our business and deploy new customers.

Why did a clean technology VC firm like NGEN Partners invest?

Like all successful venture capital firms, first and foremost they seek to invest in companies with a sound business model and huge market potential. Secondly, they look for opportunities to advance the mission and benefits of clean and green environments. You may ask yourself: how is a desktop management (virtualization) company like MokaFive “green”?

It’s very simple. Compared to VDI, or server-based computing, MokaFive's distributed virtual desktop solution offers a 90% reduction in number of servers needed –that is 90% less power, less space, less cooling and less bandwidth. In addition, the model provides *all* the benefits that accrue from a centralized management model. Also, the MokaFive model is a perfect solution to enable green initiatives, such as work from home. You can now simply provide employees with a secure, encapsulated virtual image that can run either on their machine at home or at work (bye-bye to worries about VPN on unknown, unsecured machines, access to terminals over low bandwidth, etc.). Telecommuting avoids not only the fuel used by commuters, but also the overhead energy costs needed to maintain a workplace.

Now, let’s talk about the market potential. End-user computing is being transformed by a huge variety of new devices and increasing numbers of mobile users. This change has marched right into the enterprises. As a result, managing computers with the necessary security and flexibility has become enormously expensive. MokaFive’s revolutionary approach allows you to cut traditional desktop management costs by as much as 50%. Our management solution enables you to maintain a single virtual image across any device and any user (e.g., employee, contractor, or teleworker). The virtual image is deployed to the endpoint so it eliminates the huge outlay in servers that VDI requires. The market potential to deliver a new, more effective model to update and maintain secure corporate environments across disparate, dispersed device and user types.

We are very excited to have NGEN on board, and we look forward to accelerating our business this year.

Purnima Padmanahban, VP of Products

Mac-Windows.com: "MokaFive virtual layers can rollback portions of VMs while retaining user data"

Want to know more about MokaFive's technology landscape? If so, check out the latest blog post on Mac-Windows.com—the web site for Mac-Windows integration—for more detail about virtual layers, policies, distribution, compression, and BlackBerries.

MokaFive "virtual layers" can rollback portions of VMs while retaining user data

With the layered desktop, MokaFive addresses the age old systems management problem by providing end user flexibility without compromising security. Enterprises can now reap the TCO benefits of true centralized standard image based management while enabling mass customization for their users. Unlike the classic monolithic desktop, the LivePC is separated into system, application, and user personality layers - that can be controlled and managed independently. Administrators can control and lockdown the corporate system and applications while enabling end users to customize their desktop with their own data and applications.

Purnima Padmanabhan, VP of Products and Marketing

Prediction Piece 2010: BYOPC for Today’s Workforce is a Reality

Is the only driver behind BYOPC attracting and retaining Gen-Y'ers?

Sure, the freshly minted college graduates who are entering your organization today were born in 1988. All they know is instant gratification of having information at their fingertips. As our CTO, John Whaley mentioned in a reply to Andi Mann's article, Is BYOPC Really Key to Attracting Millennials?, "a company that adopts a BYOPC program is more likely to attract millennials just by the fact they consider adopting such a program," not necessarily because it's just a perk to lure them in. Giving them the ability to bring in their hardware of choice, aka Mac, makes you look like the trend-setting, understanding employer (and then you put them to work, of course).

But is this attempt purely altruistic? We think there other drivers worth considering – namely, cost. There are deep cost advantages – some underneath the surface and worth the time to consider. By requiring employees to bring their own hardware, you get out of the hardware support business. Or if you're less inclined to give them complete choice, you have the option of corporate issued choice – you retain your volume discounts and offer a catalog of choices. Think about the flex initiatives that are growing in popularity, where companies are aiming to lower overhead by keeping workers in the office for fewer hours during the week, or fewer days. Now think of BYOPC as synonymous with use of home computers – which is more "use your own" rather than "bring your own." Here, real estate costs can be eliminated, which can represent a large percentage of the operating budget.

A client based managed VM can not only address the above scenarios in a very cost effective way, it can also eliminate the security risk associated with allowing corporate access from unmanaged, unknown endpoints. Cost effective – because it 1) Negates the need to deploy vast amounts of server infrastructure that server hosted virtual desktop solutions require; 2) Allows your users to leverage the distributed assets on hand such as personal PCs 3) Enables you to support new green initiatives such "work from home" and productivity initiative such as "Platform Choice". Secure – because it 1) Eliminates the worry of VPN clients tunneling into the perfect lockdown corporate world from dirty machines since the VPN session can now be established only from within the secure lockdown VM; 2) Removes the need to subject a user to time consuming extensive host AV scanning/could quarantining process.

If BYOPC has not looked that promising before – then it is time to look at it again. This time not just for Gen Y’ers but also for the cost saving that it can deliver to you.

MokaFive solves these exact problems while realizing the cost benefits of eliminating hardware costs, real estate costs, backend infrastructure costs, and excessive overhead. MokaFive's virtual desktop is an isolated virtual machine that sits on the endpoint – yet is fully managed, tied to a server behind the enterprise firewall that filters down policies and settings for the virtual desktop to completely lock it down and ensure safe access to the network. Whether corporate-issued choice (Mac or PC), true BYOPC or work-from-home, the cost savings are clear.

Purnima Padmanabhan, VP of Products and Marketing

Deploying XenApp Within a Virtual Desktop: The Why's & How's

We posted recently about the possibilities of creating a flexible, yet secure virtual desktop - with the right management tools. If you're familiar with the benefits of virtualization and have already invested in application virtualization technology, now you can go a step further to get security and centralized management of the entire desktop image. Deploying a well-managed virtual desktop will secure your user's operating system and simplify management of the entire environment, without sacrificing the ability to let users customize, run offline or on the go. The secret with virtual desktops is to "manage centrally, execute locally."

Deploying a flexible virtual desktop management solution is a relatively quick and simple process (a few hours to set things up), but can save IT administrators an impressive 60% on desktop support and management costs. Support costs drop as users can simply restart their virtual desktop to "rejuvenate" the original clean-state image with all of its applications and settings, wiping away any malware picked up along the way.

For instance - if you're already using XenApp, here are the basic steps:

1) Make sure your XenApp Server is configured to talk to your Domain Controller - this is important because you will be targeting apps based on users

2) Use MokaFive’s Creator to build a base LivePC image

3) Now that you have created a base image, you can install other applications, including XenApp applications, on top of it

4) From MokaFive's management console, target this LivePC to any users you choose to receive it

5) In the XenApp Access Management Console, set a number of policies for how you want XenApp to launch and run (from the server, locally, online/offline, etc.).

For step-by-step instructions, check out this document.

MokaFiveTV is Live

Curious to know more about desktop virtualization? The concept of managing virtual desktops with layers? Want to learn the backstory on how MokaFive came to be?

To satisfy your curiousity and learn about innovations in desktop computing, we invite you to check out the MokaFiveTV channel on YouTube. Our co-founder and CTO John Whaley, along with co-founder and current Stanford CS professor Monica Lam as well as other experts from the team will give you an inside look at what it's all about.

For starters, you'll find the following video episodes:
MokaFive: A brief background
Virtual Layers - Inside View
At the Whiteboard - Layering
Virtual Layers - Application Management

For an even more intimate view, follow "Joe Whaley" and MokaFive on Twitter.

Building a Flexible (yet secure) Desktop Solution

Many of you are already familiar with server virtualization and VDI and you might be looking for a virtualization approach that will help more easily secure and control desktop environments in a wider range of environments, i.e. bring-your-own-laptop, offline access, remote employees, etc.

In this post, I am going to describe one way to build a desktop environment which provides a lot of flexibility to users but still lets IT maintain control.

Consider an alternative approach to VDI: instead of running the VM image on a centralized server, the VM is running locally on the end-user's machine. The mantra is: "Manage centrally, execute remotely." This new model provides a great platform for IT organizations to customize solutions to fit their needs.

First, let's look at application virtualization and how that might fit in. Some of you maybe familiar with it - the big names in this space are: Microsoft AppV (formerly SoftGrid), VMware ThinApp (formerly Thinstall), and Citrix XenApp. In this model, an application is packaged up in a bundle and the user runs the application from this bundle in a sandbox environment on their unmanaged desktop. This is a great solution for delivering single applications to users because the application does not need to be installed manually on the local machine and it is delivered on-demand to the user. IT does not get involved in managing the OS and data on the machine.

However, not managing the OS or the rest of the desktop makes the computing environment vulnerable. In most cases, it's imperative to properly manage the environment to make sure the computer doesn't crash due to a missing security patch or that business data is not left unsecured. This is one of the reasons the desktop virtualization approach "manage centrally, execute locally" really shines - by easily securing the environment around a virtualized application:

Let's use the below image to explore the MokaFive layer approach to managing a virtual desktop, from bottom to top:

• On the lowest layer, there is the host PC or Mac operating system. The Mokafive Player, to download and run the virtual "LivePC" desktop, can be run on either platform, so you don't need to worry about cross-platform support in your solution. We take care of that.
• The layers above the host platform is the MokaFive Player and the Hypervisor. This allows you to manage the next layers above and control various security settings. IT can control what the user can or cannot do in the virtual desktop by setting policies on the central, Web-based management console.
  
• Then there is the base OS that runs inside the virtual machine (Windows XP or Vista).
  
• You can also install any corporate applications, i.e. Outlook, Word, a CRM or ERP application, etc. Together with the base OS, this can be your standard base virtual desktop image for your company or one base image for a specific department. By default, the base image is locked down by the MokaFive Player so it can't be tampered with.
  
• The top layer is where the magic happens. You can deploy additional applications to your users, based on their needs, using application virtualization technology. You can have users run applications from the server or you can have the applications streamed down to the virtual desktop, depending on performance needs. If you have an existing virtualized application installation, the MokaFive solution fits right now.
  
• Also on the top layer is the user installed applications. Using the personalization feature that is built into the MokaFive 2.0 technology, you can allow users to install their own applications on top of your standard managed image. You give your users flexibility to do whatever they want on the top layer while you maintain control on the lower layers.
  

We have tried this configuration with XenApp, AppV and ThinApp. I think this configuration provides the most flexibility to both IT and end users while at the same time, IT still maintains control.

The Basics of Image Management: Targeting & Policy Control of Virtual Desktops

In the world of server virtualization, one of the challenges is to manage all those virtual machine images. An enterprise may have a couple hundred servers but they may have a couple THOUSAND virtual machine images to manage. The reason for having so many images is that IT needs to support different OSes, different software stacks and different applications, etc. There are image management tools for server virtualization that sell for thousands of dollars just to keep track of the images.

If an enterprise is going to virtualize their desktops, the images management may become an even bigger problem. Is IT going to set up one VM image per user? Probably not. But what if different users need different applications or different access control policies? Is IT going to set up one VM image per difference? Maybe. But should they?

There is a better approach - achieved through two management concepts related to targeting and policy control.

The idea behind targeting is to allow an IT admin to "target" a particular version of an image to a particular group of users along with a unique set of access control policies. For example, Group A will use Image X and their policies are set so that they cannot paste copied data outside of the VM.

For the same Image X, IT can target it to Group B with a different set of policies. Targeting makes this possible with just a few clicks in the management software and doesn't require the creation or cloning of any images.

Different group of users can also be targeted with different version of the same image. This is great for quickly and easily testing changes to an image without a lot of fuss. For example, if the IT admin adds an application to an image but wants only a few people to test it before it is released to everyone, he or she can target the update version to a smaller group while everyone else stays in the current version.

Once everything is tested, the admin can switch the update version to become the release version and everyone would automatically get the update. It's important that only the changes to the image be sent out to users, so that users don't have to download the entire image again. When just the differential is sent the image can be updated in the background without disrupting the user at all, saving a lot of time and bandwidth.

Another way to simplify image management is to make sure that when IT updates an image, all the access policy settings remain unchanged, avoiding major headaches and time sinks. For instance, if IT has one Image X targeted to Group A with Policy 1 and the same Image X is targeted to Group B with Policy 2. When IT releases an update to the image, both groups will get the update while keeping their respective policy settings.

Of course, MokaFive's 2.0 technology and the MokaFive Suite incorporates the sophisticated image management functionality of targeting and persistant policy settings.

Here is a video that demonstrate these management features. Take a look and let us know if you have any feedback.